Gatekeeper condition #627

zhan9san · 2024-08-26T08:34:44Z

zhan9san
Aug 26, 2024

I want to use gatekeeper to update the pod with specific condition. But I don't find any document to guide me how to do it. I am not sure whether it is supported.

The condition is that only if there is only one container whose name is jnlp in pod, then modify the template. If the condition does not match, do nothing, and do not touch anything in the pod.

The original request can be found here, https://github.com/zhan9san/init-jnlp/tree/main/gatekeeper

e.g.

Need to mutate

apiVersion: v1
kind: Pod
metadata:
  labels:
    jenkins: "slave"
    jenkins/label-digest: "b38304293448f1f88fb12aa2d2e855f066c0c3d7"
    jenkins/label: "t-1"
    kubernetes.jenkins.io/controller: "https___xa-jenkins-01_telenav_comx"
  name: "t-1-tp1l7"
spec:
  containers:
    - name: jnlp
      image: customized-python-jnlp:3.12
      command:
        - /foo/bar

Do not need to mutate because there are 2 containers in a pod

apiVersion: v1
kind: Pod
metadata:
  labels:
    jenkins: "slave"
    jenkins/label-digest: "b38304293448f1f88fb12aa2d2e855f066c0c3d7"
    jenkins/label: "t-1"
    kubernetes.jenkins.io/controller: "https___jenkins-01_example_comx"
  name: "t-1-tp1l7"
spec:
  containers:
    - name: jnlp
      image: customized-python-jnlp:3.12
      command:
        - /foo/bar
  containers:
    - name: build
      image: customized-python-jnlp:3.12
      command:
        - /foo/bar

Do not need to mutate because the only container name in the pod is not jnlp.

apiVersion: v1
kind: Pod
metadata:
  labels:
    jenkins: "slave"
    jenkins/label-digest: "b38304293448f1f88fb12aa2d2e855f066c0c3d7"
    jenkins/label: "t-1"
    kubernetes.jenkins.io/controller: "https___jenkins-01_example_comx"
  name: "t-1-tp1l7"
spec:
  containers:
    - name: build
      image: customized-python-jnlp:3.12
      command:
        - /foo/bar

Here is the manifest

---
apiVersion: mutations.gatekeeper.sh/v1
kind: Assign
metadata:
  name: add-shared-volume
spec:
  applyTo:
    - groups: [""]
      kinds: ["Pod"]
      versions: ["v1"]
  match:
    scope: Namespaced
    kinds:
      - apiGroups: ["*"]
        kinds: ["Pod"]
    labelSelector:
      matchLabels:
        jenkins: slave
      matchExpressions:
        - key: jenkins/label
          operator: Exists
        - key: jenkins/label-digest
          operator: Exists
    namespaces:
      - default
  location: "spec.volumes[name:shared-volume]"
  parameters:
    assign:
      value:
        name: shared-volume
        emptyDir: {}